It is not possible for all people to follow the same authentication path in a single place. The three categories of people are different if they want convenience, compliance and leadership. WiFi’s wireless certification system, if it supports only one model, will inevitably be biased. How to keep the visitors’ mode and the real name pattern together without interfering with each other is a question that cannot be bypassed when deployed.
We'll tell you who has to be named and what can be light.
Legally, it's called"Wireless access to the public"The scene is focused on"Public". Internal staff, regular partners are strictly absent"Public"When it is clear what means of certification, which privileges and which life cycle they will have to live with. We've seen a company that forces everyone to write their names, collects the code every day at work, complains about it, changes the number of jobs to the job number and then disappears.
Elements of technology realization for the real-name model
The real name of the visitor usually takes a cell phone number plus a text message code, and if necessary, you can add an ID card."Fake name"That's one on the page."I've agreed."buttons, but do not authenticate the identity, which is zero in the eyes of the regulator. When we make a real name model, we are forced to at least one link that can be found in the true identification document and to write the results of this chain into a log to ensure access in the future.
Border control in light-volume visitor mode
Some scenes do not really need to be strictly named, like the ad hoc network of internal meetings for guests."Visitors ' Code"Or..."Time-limited exemption for authentication"But there must be boundaries: time limits, bandwidth restrictions, access limits. No light-weight models of borders are equivalent to opening holes on firewalls. We suggest that any light-weight model should have a clear expiry date, with the point automatically failing and without access to inner resources. Light amounts not to unregulated, but to a suitable control.
How the two models share a front end
Users are expected to see a certified page that automatically diverts from the scene, rather than exposing everyone to the same complex page. It is common practice for the system to identify end sources after WiFi, and for employees to take the trust channel automatically and visitors to the real name page."I'm an employee. I'm a visitor."The switch is made to the side where compliance is higher. We do not usually recommend that both modes of entry be as visible, and that visitors avoid having their staff access lanes open. The diversion logic is written in the scheme and cannot be perceived by users.
Permissions and VLAN follow pattern.
The way that the network is based on Internet access varies. Real visitors are restricted to VLAN, and staff are able to access internal systems; light visitors are allowed to enter more restricted areas of isolation. These three people have pre-positioned VLAN on the switchboard, firewall strategies are prepared, certification systems are certified to issue the corresponding authorization correctly. We have dealt with an accident, visitor patterns and employee models were validated and placed in the same VLAN, resulting in visitors having access to internal printers and shared folders, although not significant, but security audits have been identified as a high risk.
Life cycle management does not allow visitors to accumulate.
The visitors’ mode accounts, if built and kept intact, are a bunch of zombie accounts, both resource-taking and risk-bearing. Each model is designed with automatic cleanup rules: time-bound visitors expire, text-based visitors can keep regular files that have been long unincorporated, and staff members leave the home identity source simultaneously cancels them off. We see a park area where thousands of records are left out of the house in the guest account, no one moves, and then cleans up like ice. Life cycle rules are set to an end 10,000 times easier than they will be.
Co-existence is not a compromise, it's a fine operation.
A lot of people think of double models as a combination."I can't help but support it."It is a professional practice to give different types of people different certification experiences and controls, and to satisfy compliance without upsetting their own people. Model design is good and bad, not necessarily speaking, but it is felt. Compatibility with co-existence, less abuse by IT, better compliance, and business sector satisfaction are the ones that win more.